@vincemakes/kiso-code 0.31.0 → 0.32.0

package/dist/auth/oauth/chatgpt.js

@@ -164,6 +164,12 @@ export const chatgptFlow = {
         const flow = createAuthorizationFlow(redirectUri);
         const server = await startCallbackServer(flow.state, cb.host, cb.port);
         interaction.notify(`open this URL to sign in:\n  ${flow.url}`);
+        // OR-4 (owner, 2026-09-09): the URL is opened for the person when the
+        // caller can — the printed line stays the fallback and the paste path.
+        if (interaction.open !== undefined) {
+            interaction.open(flow.url);
+            interaction.notify("(opened in your browser — if nothing opened, copy the URL above)");
+        }
         let code = null;
         if (server !== null) {
             interaction.notify(`waiting for the browser to come back to ${redirectUri} … (or paste the redirected URL here)`);

package/dist/auth/oauth/index.d.ts

@@ -14,6 +14,11 @@ export interface LoginInteraction {
     /** Ask the person for a line (the pasted redirect URL or code when the
      *  local callback cannot be reached); resolves "" when unavailable. */
     readonly prompt: (question: string) => Promise<string>;
+    /** OR-4: open the authorize URL in the person's browser, when there is
+     *  one. OPTIONAL — the CLI passes it on a TTY; tests and pipes never do,
+     *  so nothing opens a browser under a test rig. The URL is always
+     *  printed too: this is a convenience, never the only path. */
+    readonly open?: (url: string) => void;
     readonly signal?: AbortSignal;
     /** Test seam: the callback listener's host/port (defaults 127.0.0.1:1455). */
     readonly callback?: {

package/dist/breaker.d.ts

@@ -0,0 +1,57 @@
+/**
+ * LT-2 — the loop breaker (kiso-doc/kiso-lt1-mini-spec-2026-09-09.md, part
+ * one, corrected by the chain law — see below).
+ *
+ * An agent that keeps issuing the SAME failing call — same tool, same
+ * input, failure after failure — is not making progress, and since R3e
+ * removed the silent turn limit nothing stopped it. This extension does,
+ * in the one place the product already decides tool calls: the approval
+ * chain. It rides the chain like the five mode tiers do (a `decide()` that
+ * speaks or abstains), placed at the HEAD so that when it speaks, the
+ * verdict's `decidedBy` names it.
+ *
+ * THE VERDICT IS A DENY WITH A REASON, NOT AN ASK. The spec asked for a
+ * human question; the chain composes deny > allow > ask over the speaking
+ * verdicts, so an `ask` from here would lose to the tier's `allow` (a read
+ * under `default`, anything under `bypass`) and the loop would go on. A
+ * deny wins over every tier — the same law that lets a user extension's
+ * deny beat `bypass` — and the model receives it as the call's result with
+ * the reason (the 1c grammar: refuse with a reason and continue), so the
+ * next turn has to change course. The human sees the denial on the
+ * transcript with `decidedBy: breaker`; the 50-turn checkpoint (part two)
+ * is where a human is asked.
+ *
+ * Counting: CONSECUTIVE failed results of one (tool, input) key within a
+ * run. A success, a different call, or the run's terminal resets it. The
+ * third identical attempt is denied. N = 3 is named below; dogfood moves it
+ * with a finding, never silently.
+ */
+import type { Event, KisoExtension, PolicyVerdict } from "@vincemakes/kiso-core";
+/** The third identical failed attempt is the one refused. */
+export declare const BREAKER_LIMIT = 3;
+/** The name the verdict wears (`decidedBy`). */
+export declare const BREAKER_NAME = "breaker";
+/** A stable key for (tool, input): object keys sorted at every depth, so
+ *  two calls that mean the same thing key the same whatever order the
+ *  model wrote the fields in. */
+export declare function callKey(name: string, input: unknown): string;
+/** The per-run state, kept small: the last failed key and how many times
+ *  in a row it failed. `calls` maps a callId to its key while a call is in
+ *  flight (the failure arrives on the result event, keyed by callId). */
+export interface BreakerState {
+    lastKey: string | null;
+    failures: number;
+    readonly calls: Map<string, string>;
+}
+export declare function breakerState(): BreakerState;
+/** What the log says, applied to the state. Exported so the rule is testable
+ *  as a pure function of the event sequence. */
+export declare function observe(state: BreakerState, event: Event): void;
+/** The verdict for a call about to be decided: the (limit − 1)th consecutive
+ *  failure of this exact key has already happened, so this attempt would be
+ *  the limit-th — refused, with the count in the reason. */
+export declare function verdict(state: BreakerState, name: string, input: unknown, limit?: number): PolicyVerdict;
+/** The extension: one state per process (a session runs one run at a time,
+ *  and the terminal resets it), the log observed through the hook, the
+ *  verdict through the chain. */
+export declare function breakerExtension(limit?: number): KisoExtension;

package/dist/breaker.js

@@ -0,0 +1,119 @@
+/**
+ * LT-2 — the loop breaker (kiso-doc/kiso-lt1-mini-spec-2026-09-09.md, part
+ * one, corrected by the chain law — see below).
+ *
+ * An agent that keeps issuing the SAME failing call — same tool, same
+ * input, failure after failure — is not making progress, and since R3e
+ * removed the silent turn limit nothing stopped it. This extension does,
+ * in the one place the product already decides tool calls: the approval
+ * chain. It rides the chain like the five mode tiers do (a `decide()` that
+ * speaks or abstains), placed at the HEAD so that when it speaks, the
+ * verdict's `decidedBy` names it.
+ *
+ * THE VERDICT IS A DENY WITH A REASON, NOT AN ASK. The spec asked for a
+ * human question; the chain composes deny > allow > ask over the speaking
+ * verdicts, so an `ask` from here would lose to the tier's `allow` (a read
+ * under `default`, anything under `bypass`) and the loop would go on. A
+ * deny wins over every tier — the same law that lets a user extension's
+ * deny beat `bypass` — and the model receives it as the call's result with
+ * the reason (the 1c grammar: refuse with a reason and continue), so the
+ * next turn has to change course. The human sees the denial on the
+ * transcript with `decidedBy: breaker`; the 50-turn checkpoint (part two)
+ * is where a human is asked.
+ *
+ * Counting: CONSECUTIVE failed results of one (tool, input) key within a
+ * run. A success, a different call, or the run's terminal resets it. The
+ * third identical attempt is denied. N = 3 is named below; dogfood moves it
+ * with a finding, never silently.
+ */
+/** The third identical failed attempt is the one refused. */
+export const BREAKER_LIMIT = 3;
+/** The name the verdict wears (`decidedBy`). */
+export const BREAKER_NAME = "breaker";
+/** A stable key for (tool, input): object keys sorted at every depth, so
+ *  two calls that mean the same thing key the same whatever order the
+ *  model wrote the fields in. */
+export function callKey(name, input) {
+    return `${name}\0${stable(input)}`;
+}
+function stable(v) {
+    if (Array.isArray(v))
+        return `[${v.map(stable).join(",")}]`;
+    if (v !== null && typeof v === "object") {
+        const o = v;
+        return `{${Object.keys(o)
+            .sort()
+            .map((k) => `${JSON.stringify(k)}:${stable(o[k])}`)
+            .join(",")}}`;
+    }
+    return JSON.stringify(v) ?? "undefined";
+}
+export function breakerState() {
+    return { lastKey: null, failures: 0, calls: new Map() };
+}
+/** What the log says, applied to the state. Exported so the rule is testable
+ *  as a pure function of the event sequence. */
+export function observe(state, event) {
+    switch (event.type) {
+        case "tool_call_end":
+            state.calls.set(event.callId, callKey(event.name, event.input));
+            return;
+        case "tool_result": {
+            const key = state.calls.get(event.callId);
+            state.calls.delete(event.callId);
+            if (key === undefined)
+                return;
+            if (!event.isError) {
+                state.lastKey = null;
+                state.failures = 0;
+                return;
+            }
+            if (state.lastKey === key)
+                state.failures += 1;
+            else {
+                state.lastKey = key;
+                state.failures = 1;
+            }
+            return;
+        }
+        case "terminal":
+            // a run's end is a clean slate: the next run starts at zero
+            state.lastKey = null;
+            state.failures = 0;
+            state.calls.clear();
+            return;
+        default:
+            return;
+    }
+}
+/** The verdict for a call about to be decided: the (limit − 1)th consecutive
+ *  failure of this exact key has already happened, so this attempt would be
+ *  the limit-th — refused, with the count in the reason. */
+export function verdict(state, name, input, limit = BREAKER_LIMIT) {
+    if (state.lastKey !== null && state.lastKey === callKey(name, input) && state.failures >= limit - 1) {
+        return {
+            action: "deny",
+            reason: `${BREAKER_NAME}: the same ${name} call failed ${state.failures} times in a row — change the input or the approach; the identical call is not tried again`,
+        };
+    }
+    return { action: "abstain" };
+}
+/** The extension: one state per process (a session runs one run at a time,
+ *  and the terminal resets it), the log observed through the hook, the
+ *  verdict through the chain. */
+export function breakerExtension(limit = BREAKER_LIMIT) {
+    const state = breakerState();
+    return {
+        name: BREAKER_NAME,
+        hooks: {
+            async onEvent(event) {
+                observe(state, event);
+            },
+        },
+        approvals: [
+            {
+                decide: async (payload) => verdict(state, payload.name, payload.input, limit),
+            },
+        ],
+    };
+}

package/dist/chat.d.ts

@@ -38,6 +38,15 @@ export declare function estimateCtxRatio(session: AgentSession): number;
  *  their continuation envelopes, the output reserve when known) over the
  *  window. Still ~ (chars/4). The auto-compact policy does NOT read this
  *  (see autoCompactRatio) — moving the policy's number is A1b's. */
+/** OR-8 (owner, 2026-09-09): the status row names the effort next to the
+ *  model — `gpt-5.6-sol · xhigh` — whenever the live binding carries one;
+ *  the provider's default shows as the bare model, as before. The effort
+ *  is the session's own (the durable profile), never the CLI's memory. */
+export declare function statusModelLabel(session: {
+    readonly reasoning?: {
+        readonly effort: string;
+    };
+}): string;
 export declare function displayCtxRatio(session: AgentSession): number;
 /** A1a: the number the auto-compact decision reads — the pre-A1a estimate,
  *  unchanged this round, named so a gate can pin that it did not move. */
@@ -161,6 +170,19 @@ export declare function parseSaferOptions(text: string): SaferOption[] | null;
  * echo is UI, the chip is the record; the momentary double-render is
  * the design's explicit point).
  */
+/** LT-2b — the turn checkpoint (kiso-doc/kiso-lt1-mini-spec-2026-09-09.md,
+ *  part two). R3e stands: no hard turn limit on an interactive session. What
+ *  a long run gets instead is a QUESTION every CHECKPOINT_TURNS model turns —
+ *  the run is paused between two model turns (the generator is simply not
+ *  pulled while the panel is up; the kernel does nothing meanwhile) and the
+ *  human answers. "Keep going" resumes it, the next question one checkpoint
+ *  later; "Stop here" aborts the run — `aborted by user`, resumable, never
+ *  silent. A decline (esc) is "keep going": the run was already running, and
+ *  esc on a panel is the panel's decline, not the run's abort. Headless
+ *  entries never see it: the panel needs the dock, and a pipe, `-p` or a
+ *  task file has none. 50 is named here; a finding moves it, never a stray
+ *  edit. */
+export declare const CHECKPOINT_TURNS = 50;
 export declare function consumeRun(session: AgentSession, run: Run, input: LineInput, turnNo: number, faux: boolean, statusCb: ((usage: RunUsage, ctxRatio: number, costUsd?: number | null) => void) | null, 
 /** W21: the amend words ("Yes + feedback") ride the NEXT user turn —
  *  threaded from chat's submitTurn; absent in the recovery flow
@@ -176,6 +198,14 @@ export type ChatEnd = {
 } | {
     readonly next: "switch";
     readonly id: string;
+}
+/** §2.5: the caller REBUILDS the agent and re-enters on the same id.
+ *  Not "switch": switching keeps the agent and only changes the id,
+ *  which would reload nothing at all — the tool registry lives in the
+ *  agent's constructor. */
+ | {
+    readonly next: "reload";
+    readonly id: string;
 };
 /** The session-navigation seam main provides: the OTHER sessions'
  *  ids, and (when a dock is up) the existing picker. */

package/dist/chat.js

@@ -6,11 +6,11 @@
  */
 import { readFileSync, statSync } from "node:fs";
 import { escapeTerminal, cacheHitPct, idleStatus, palette, renderEvent, renderRecap, runningStatus, toolTarget, verifyOfferView, STATUS_GLYPHS, } from "@vincemakes/kiso-tui";
-import { deletionRiskHint, editFileDiff, writeFileDiff } from "@vincemakes/kiso-tui";
+import { askView, deletionRiskHint, editFileDiff, writeFileDiff } from "@vincemakes/kiso-tui";
 import { canonicalTargetPath, shellProgressPath } from "@vincemakes/kiso-tools-node";
 import { canonicalizeUsage } from "@vincemakes/kiso-runtime";
 import { canonicalizeUsageForModel, requestBudget } from "@vincemakes/kiso-runtime/internal";
-import { dispatch } from "./dispatch.js";
+import { dispatch, abortBangCommand } from "./dispatch.js";
 import { agentBaseUrl, agentModel, body, bodyLog, configuredWindow, dock } from "./state.js";
 import { attachImages } from "./attachments.js";
 import { lookupModelMetadata } from "@vincemakes/kiso-runtime/internal";
@@ -69,6 +69,14 @@ export function estimateCtxRatio(session) {
  *  their continuation envelopes, the output reserve when known) over the
  *  window. Still ~ (chars/4). The auto-compact policy does NOT read this
  *  (see autoCompactRatio) — moving the policy's number is A1b's. */
+/** OR-8 (owner, 2026-09-09): the status row names the effort next to the
+ *  model — `gpt-5.6-sol · xhigh` — whenever the live binding carries one;
+ *  the provider's default shows as the bare model, as before. The effort
+ *  is the session's own (the durable profile), never the CLI's memory. */
+export function statusModelLabel(session) {
+    const effort = session.reasoning?.effort;
+    return effort !== undefined && effort !== "default" ? `${agentModel} · ${effort}` : agentModel;
+}
 export function displayCtxRatio(session) {
     return requestBudget(session.requestParts(), contextWindowTokens()).ratio;
 }
@@ -127,7 +135,24 @@ endpoint) {
         const m = Math.min(prevTotal, total) - c.cacheRead;
         missed = m > CACHE_MISS_FLOOR ? m : null;
     }
-    return { usage: { in: c.input, out: c.output, cache: c.cacheRead, known: ev.known }, total, missed, costUsd: c.costUsd };
+    // OR-10 (owner, 2026-09-09): a backend whose cache figure cannot be
+    // observed has no cache figure. The ChatGPT backend answers
+    // `cached_tokens` 0 to a third-party client on every request, so its 0
+    // and "not reported" are one value, and a CH 0% built on it claims a
+    // measurement that never happened. The registry ROW says which
+    // endpoints these are; the status row, the recap and the usage line
+    // already render a null cache as nothing ("an unmeasured cache is not
+    // a 0% cache"), so this is one decision at the one place the endpoint
+    // is known. The trace ledger is written by the runtime from the
+    // backend's own words and keeps its 0 — the display's rule, not the
+    // record's.
+    const unobservable = model !== undefined && lookupModelMetadata(model, endpoint)?.capabilities.promptCaching === "unobservable";
+    return {
+        usage: { in: c.input, out: c.output, cache: unobservable ? null : c.cacheRead, known: ev.known },
+        total,
+        missed: unobservable ? null : missed,
+        costUsd: c.costUsd,
+    };
 }
 /** v2b: the spinner merged into the STATUS BAR (the v2a standalone glyph
  *  is gone) — docked only, 200ms rotation between the request and the
@@ -517,6 +542,37 @@ function toRenderInput(ev) {
  * echo is UI, the chip is the record; the momentary double-render is
  * the design's explicit point).
  */
+/** LT-2b — the turn checkpoint (kiso-doc/kiso-lt1-mini-spec-2026-09-09.md,
+ *  part two). R3e stands: no hard turn limit on an interactive session. What
+ *  a long run gets instead is a QUESTION every CHECKPOINT_TURNS model turns —
+ *  the run is paused between two model turns (the generator is simply not
+ *  pulled while the panel is up; the kernel does nothing meanwhile) and the
+ *  human answers. "Keep going" resumes it, the next question one checkpoint
+ *  later; "Stop here" aborts the run — `aborted by user`, resumable, never
+ *  silent. A decline (esc) is "keep going": the run was already running, and
+ *  esc on a panel is the panel's decline, not the run's abort. Headless
+ *  entries never see it: the panel needs the dock, and a pipe, `-p` or a
+ *  task file has none. 50 is named here; a finding moves it, never a stray
+ *  edit. */
+export const CHECKPOINT_TURNS = 50;
+async function checkpointAsk(input, turns) {
+    const verdict = await askPanel(input, askView({
+        questions: [
+            {
+                question: `${turns} turns and still working — keep going?`,
+                header: "checkpoint",
+                options: [
+                    { label: "Keep going", description: `the next question at ${turns + CHECKPOINT_TURNS}` },
+                    { label: "Stop here", description: "the run ends as aborted by you; kiso resume continues it later" },
+                ],
+            },
+        ],
+    }));
+    if (verdict.action !== "answers" || !("answers" in verdict.result))
+        return true; // declined: nothing changes
+    const first = verdict.result.answers[0];
+    return !(first !== undefined && "choice" in first && first.choice === "Stop here");
+}
 export async function consumeRun(session, run, input, turnNo, faux, statusCb, 
 /** W21: the amend words ("Yes + feedback") ride the NEXT user turn —
  *  threaded from chat's submitTurn; absent in the recovery flow
@@ -547,8 +603,16 @@ submitTurn) {
         tailers.delete(callId);
     };
     try {
+        let modelTurns = 0;
         for await (const ev of run) {
             last = ev;
+            // LT-2b: a model turn ends with its stop; every CHECKPOINT_TURNS of them
+            // the human is asked before the run is pulled any further
+            if (ev.type === "stop" && dock.active) {
+                modelTurns += 1;
+                if (modelTurns % CHECKPOINT_TURNS === 0 && !(await checkpointAsk(input, modelTurns)))
+                    run.abort();
+            }
             if (ev.type !== "thinking") {
                 if (thinkingSince !== null) {
                     thoughtSeconds += (Date.now() - thinkingSince) / 1000;
@@ -791,6 +855,17 @@ submitTurn) {
                         // is a sentence addressed to a human; it needs no edge.
                         body.notice('answer truncated at max_tokens — say "continue" to finish');
                     }
+                    // OR-5 (the ChatGPT real leg, 2026-09-09): a run that ended in an
+                    // ERROR terminal printed nothing but the recap — the vendor's 400
+                    // lived in the durable log alone and the turn read as "took 1s".
+                    // A failure that fires silently is indistinguishable from a
+                    // crash, the one thing this product must never be: the mapped
+                    // error is named here, before the recap, code and status and the
+                    // provider's own words.
+                    if (ev.outcome.kind === "error") {
+                        const e = ev.outcome.error;
+                        body.notice(`run failed — ${e.code}${e.status !== undefined ? ` ${e.status}` : ""}${e.retryable ? " (retryable)" : ""}: ${escapeTerminal(e.message)}`);
+                    }
                     bodyLog(renderRecap({
                         seconds: Math.round((Date.now() - turnStart) / 1000),
                         // R3g: the work terms are NOT passed — the fold line
@@ -842,6 +917,9 @@ export async function chat(session, faux, input, autoCompact, nav) {
     // the switch directive — set once by dispatch's /clear or /resume,
     // resolved through the end signal so the final awaits still run
     let switchTo = null;
+    // §2.5: the reload directive — same resolution path as switchTo, so the
+    // final awaits still run before chat() returns.
+    let reloadReq = false;
     let resolveEnd = () => { };
     const endSignal = new Promise((r) => {
         resolveEnd = r;
@@ -995,6 +1073,13 @@ export async function chat(session, faux, input, autoCompact, nav) {
             exitAtEmptyPrompt();
     });
     input.onEscape(() => {
+        // §2.2: a `!` command is offered the key FIRST. The two are never
+        // both in flight — the dispatcher is serialized on the chain — so
+        // this is an ordering, not a precedence rule.
+        if (abortBangCommand()) {
+            console.log("\n[aborting command]");
+            return;
+        }
         if (currentRun) {
             console.log("\n[aborting run]");
             pendingAsk?.();
@@ -1083,7 +1168,7 @@ export async function chat(session, faux, input, autoCompact, nav) {
         // TUI2-R1 (E): the meter rides the idle row — both fields omitted
         // when unknown, so a session that has not called the model paints
         // exactly the pre-round row.
-        dock.setStatus(idleStatus(getMode() === "plan" ? "plan (read-only)" : getMode(), agentModel, displayCtxRatio(session), {
+        dock.setStatus(idleStatus(getMode() === "plan" ? "plan (read-only)" : getMode(), statusModelLabel(session), displayCtxRatio(session), {
             cacheHitPct: cacheHitPct(runUsage),
             costUsd: spentUsd,
         }));
@@ -1101,6 +1186,17 @@ export async function chat(session, faux, input, autoCompact, nav) {
     // a turn ended. One call, and the SAME formatter — a boot-time copy of
     // the row would drift from the real one the moment either changed.
     paintIdle();
+    // DF-0311-F1 (the 0.31.1 dogfood, reproduced by the owner): the meter is
+    // the last TURN's figure. After /model the row named the NEW model beside
+    // the OLD model's CH until the next recap — and beside a model whose
+    // cache is unobservable (OR-10) that is a measurement it never had. A new
+    // binding starts with no meter; its first turn paints the first figure.
+    // The session's running cost is untouched: it is the session's, not the
+    // binding's, and the row does not render it anyway.
+    const modelSwitched = () => {
+        runUsage = { in: null, out: null, cache: null, known: false };
+        paintIdle();
+    };
     const statusCb = (u, ctx, costUsd) => {
         runUsage = u;
         addCost(costUsd ?? null);
@@ -1171,6 +1267,7 @@ export async function chat(session, faux, input, autoCompact, nav) {
         chainRef,
         isRunning: () => currentRun !== null,
         paintIdle,
+        modelSwitched,
         submitTurn,
         estimateCtx: () => displayCtxRatio(session),
         contextWindow: () => contextWindowTokens(),
@@ -1181,6 +1278,10 @@ export async function chat(session, faux, input, autoCompact, nav) {
             switchTo = id;
             resolveEnd();
         },
+        requestReload: () => {
+            reloadReq = true;
+            resolveEnd();
+        },
         sessions: () => nav?.sessions() ?? [],
         ...(nav?.pick !== undefined ? { pickSession: nav.pick } : {}),
     };
@@ -1220,6 +1321,8 @@ export async function chat(session, faux, input, autoCompact, nav) {
     // chain action (the sentinel's control char marks the key, so a typed
     // "expand" turn is never intercepted).
     input.onExpand(() => dispatch("\x12expand", dispatchCtx));
+    input.onThink?.(() => dispatch("\x14think", dispatchCtx));
+    input.onEditor?.(() => dispatch("\x07editor", dispatchCtx));
     // E1 §3 — ctrl+x and `/copy` are the same action reached two ways, so
     // they are the same sentinel: one implementation, one behaviour.
     input.onCopy(() => dispatch("\x18copy", dispatchCtx));
@@ -1287,5 +1390,9 @@ export async function chat(session, faux, input, autoCompact, nav) {
     // runs before the exit or the chain is already settled. One level is
     // enough: the /compact segment appends nothing of its own.
     await chainRef.current;
-    return switchTo === null ? { next: "exit" } : { next: "switch", id: switchTo };
+    if (switchTo !== null)
+        return { next: "switch", id: switchTo };
+    // a switch beats a reload: /resume and /clear are going somewhere else,
+    // and the agent they land on is rebuilt by the caller either way.
+    return reloadReq ? { next: "reload", id: session.id } : { next: "exit" };
 }

package/dist/config.d.ts

@@ -46,6 +46,9 @@ export interface ModelProfile {
     /** PH-1c.1: opt-in Anthropic prompt caching for this profile —
      *  default off (a request-byte cost behavior never flips silently). */
     readonly promptCaching?: boolean;
+    /** LT-1: milliseconds the model stream may go silent before the request
+     *  is aborted and retried. Default 120,000; 0 disables the watchdog. */
+    readonly streamIdleMs?: number;
 }
 export interface AutoCompactConfig {
     readonly thresholdRatio: number;

package/dist/config.js

@@ -31,6 +31,7 @@ import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { kisoHome } from "./state.js";
 import { AuthError, getCredential, providerIdOf } from "./auth/credentials.js";
+import { BUILTIN_MANIFESTS } from "@vincemakes/kiso-runtime/internal";
 const KINDS = ["openai-compat", "anthropic", "openai-responses"];
 const MODES_LIST = ["manual", "default", "accept-edits", "plan", "bypass"];
 export class ConfigError extends Error {
@@ -99,12 +100,15 @@ export function parseConfig(text, source) {
                 fail(`models.${name}.baseUrl`, "expected a string");
             if (p.promptCaching !== undefined && typeof p.promptCaching !== "boolean")
                 fail(`models.${name}.promptCaching`, "expected a boolean");
+            if (p.streamIdleMs !== undefined && (typeof p.streamIdleMs !== "number" || !Number.isFinite(p.streamIdleMs) || p.streamIdleMs < 0))
+                fail(`models.${name}.streamIdleMs`, "expected a non-negative number of milliseconds (0 disables the stream watchdog)");
             models[name] = {
                 kind: p.kind,
                 model: p.model,
                 ...(typeof p.apiKeyEnv === "string" ? { apiKeyEnv: p.apiKeyEnv } : {}),
                 ...(typeof p.baseUrl === "string" ? { baseUrl: p.baseUrl } : {}),
                 ...(typeof p.promptCaching === "boolean" ? { promptCaching: p.promptCaching } : {}),
+                ...(typeof p.streamIdleMs === "number" ? { streamIdleMs: p.streamIdleMs } : {}),
             };
         }
         out.models = models;
@@ -209,6 +213,15 @@ export function authForProfile(name, p) {
             throw new ConfigError(`model ${name}: signed in to ${providerId} with OAuth, but this profile's adapter needs an API key — run \`kiso login ${providerId}\` with a key, or \`kiso logout ${providerId}\` to use the env var ${p.apiKeyEnv ?? "(none configured)"}`);
         }
     }
+    // OR-2 (2026-09-09): a provider whose manifest takes NO API key (the ChatGPT
+    // backend: authMethods ["oauth"]) is never an "unauthenticated endpoint" —
+    // with nothing stored it is a profile waiting for its sign-in. Without this
+    // the keyless rule below handed it a placeholder key, `/model` said
+    // "available", and the adapter (an apiKey selects the first-party target)
+    // would have sent an unauthenticated request to the wrong URL.
+    if (providerId !== null && !manifestTakesKey(providerId)) {
+        throw new ConfigError(`model ${name}: unavailable — not signed in: run \`kiso login ${providerId}\` (this provider takes no API key)`);
+    }
     if (p.apiKeyEnv === undefined)
         return { type: "api-key", apiKey: "none", source: "none" };
     const fromEnv = process.env[p.apiKeyEnv];
@@ -217,6 +230,13 @@ export function authForProfile(name, p) {
     const hint = providerId !== null ? `run \`kiso login ${providerId}\` or set the env var ${p.apiKeyEnv}` : `set the env var ${p.apiKeyEnv}`;
     throw new ConfigError(`model ${name}: unavailable — no credential: ${hint} (configs never store keys, only the env-var name)`);
 }
+/** OR-2: does the provider's manifest admit an API key (or no auth at all)?
+ *  An unknown id answers yes — the keyless-endpoint rule stays for custom
+ *  origins; only a manifest that says OAuth-only takes the sign-in path. */
+function manifestTakesKey(providerId) {
+    const m = BUILTIN_MANIFESTS.find((x) => x.id === providerId);
+    return m === undefined || m.authMethods.includes("api-key") || m.authMethods.includes("none");
+}
 /** The reason a profile is unavailable, for the surfaces that print it. */
 export function unavailableReason(name, p) {
     try {

package/dist/dispatch.d.ts

@@ -18,6 +18,11 @@ export interface DispatchCtx {
     readonly isRunning: () => boolean;
     /** the /mode switch repaints the status bar at once. */
     readonly paintIdle: () => void;
+    /** DF-0311-F1: a successful /model switch repaints the row with NO meter.
+     *  The meter is the last TURN's figure, measured on the binding that is
+     *  gone; a binding that has not run yet paints none — an unmeasured
+     *  cache is not a 0% cache, and it is not the previous model's either. */
+    readonly modelSwitched: () => void;
     /** submit a real turn: queue + chain (the turn closure lives in chat). */
     readonly submitTurn: (line: string) => void;
     /** the /status context estimate. */
@@ -28,13 +33,28 @@ export interface DispatchCtx {
     /** the /resume+/clear mini-spec: end this chat() with a switch to
      *  another session — main re-enters chat there; the editor survives. */
     readonly requestSwitch: (id: string) => void;
+    /** §2.5: end this chat() with a REBUILD of the agent on the SAME
+     *  session — extensions, skills and config are read again. */
+    readonly requestReload: () => void;
     /** every durable session id (the /resume validation + listing). */
     readonly sessions: () => readonly string[];
     /** the dock's session picker, when one exists (bare /resume). */
     readonly pickSession?: () => Promise<string | null>;
 }
-/** The ONE dispatcher — slash commands, exit, and turns. The recovery
- *  replay routes through it too — a queued "/last" must never become a
- *  user turn (v2c: the rl lives in main, so lines arrive earlier and the
- *  queue is the common path). */
+/** esc while a `!` command runs kills it — the SAME abort the shell tool
+ *  gives a model's call, so the whole process group goes, children
+ *  included. Exported because the esc key reaches the editor first: chat
+ *  offers it here before it reaches a model run, and only one of the two
+ *  can be in flight. */
+export declare function abortBangCommand(): boolean;
+/** §2.2 — what a submitted line asks for, if it asks for a shell at all.
+ *  Split out from the dispatcher so the rule is testable without a
+ *  terminal: `null` means this is not the gesture and the line is a turn.
+ *
+ *  `!!` is checked before `!` because the longer prefix is the narrower
+ *  claim; testing `!` first would swallow both. */
+export declare function parseBang(trimmed: string): {
+    readonly command: string;
+    readonly send: boolean;
+} | null;
 export declare function dispatch(line: string, ctx: DispatchCtx): void;